From 0339929663cf9bcc3c0be854a40b66cc40a8abd9 Mon Sep 17 00:00:00 2001
From: Fabian Jocks <24557998+iamfj@users.noreply.github.com>
Date: Thu, 23 Apr 2026 10:31:58 +0200
Subject: [PATCH] fix(ci): bind release job to npm-publish environment

Make env-scoped NPM_TOKEN available in release job.

Add explicit npm auth preflight to fail fast.
---
 .github/workflows/release-check.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/workflows/release-check.yml b/.github/workflows/release-check.yml
index dd7f0e1c..0cf67a45 100644
--- a/.github/workflows/release-check.yml
+++ b/.github/workflows/release-check.yml
@@ -19,6 +19,7 @@ concurrency:
 jobs:
   release:
     runs-on: ubuntu-latest
+    environment: npm-publish
     steps:
       - name: Guard workflow_dispatch caller permissions
         if: ${{ github.event_name == 'workflow_dispatch' }}
@@ -122,6 +123,16 @@ jobs:
       - name: Type check
         run: npx tsc --noEmit
 
+      - name: Verify npm auth
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          test -n "${NODE_AUTH_TOKEN}" || {
+            echo "NPM_TOKEN missing (check job environment + secret scope)"
+            exit 1
+          }
+          npm whoami --registry=https://registry.npmjs.org/
+
       - name: Run semantic-release
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}